Ministries identify critical entities in their sectors

Ministries are responsible for identifying critical entities in their the sectors. Identification is based on the CER Act and the detailed guidance issued by the European Commission. The national plan and the national CER risk assessment provide a basis for identification. Ministries must finalise their first list of critical entities by 17 July 2026. The decision remains in force for up to four years.

The Ministry of the Interior coordinates the overall process, maintains the national list and issues statements during identification. The National Emergency Supply Agency and other ministries participate in the assessments where needed.

An entity is identified as critical if it:

• provides an essential service
• operates in Finland and its infrastructure is located in Finland
• and an incident would have significant disruptive effects on service provision or on dependent sectors.

Statutory obligations for critical entities

The CER Act sets obligations for entities designated as critical. A critical entity must prepare a risk assessment that identifies disruptions and threats that could endanger its services or operations. The entity must also draw up a resilience plan that explains how the continuity of services will be ensured in the event of a disruption.

Critical entities must notify the competent authority and the Government Situation Centre of incidents that significantly disrupt or have the potential to significantly disrupt the provision of services.